I'm hoping to try this during our maintenance window next week, but according to TAC...
#copy sftp flash user ftpuser ftp.server.ip KB_16_08_0003.swi secondary
#boot set-default flash primary
#write memory
#boot standby
#show redundancy (wait for sync)
#redundancy switchover
...will upgrade with very little to no downtime. In their lab, there were no pings dropped. I'll add my results next week.